Lynis

No entries match these filters. Clear filters

1. 3.1.7 Jun 25, 2026 · release notes

   Lynis 3.1.7 expands EOL database with CachyOS, NixOS, AlmaLinux, openSUSE Leap, and updated RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence./Ubuntu/Alpine/Fedora dates.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.7 https://github.com/CISOfy/lynis.git
   # already have the repo? check out this version:
   $ git checkout 3.1.7

   • Adds CachyOS to the OS end-of-life database (with corrected OS detection support).
   • Adds NixOS EOL data to the end-of-life database.
   • Adds AlmaLinux to the EOL database.
   • Adds openSUSE Leap to the EOL database.
   • Adds EOL dates for Alpine 3.22 and 3.23.

   +4 more show less

   • Adds EOL dates for Ubuntu 25.10 and 26.04.
   • Updates RHEL 8 EOL date and adds RHEL 9 and 10 dates.
   • Adds and updates Fedora EOL dates including Fedora 43.
   • Adds Debian 13 EOL date.

   9 details in Everything

2. 3.1.6 Oct 23, 2025 · release notes

   Lynis 3.1.6 adds CachyOS/macOS Tahoe/OpenMandriva support, NFLOG iptables detection, and improved Wazuh agent detection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.6 https://github.com/CISOfy/lynis.git
   # already have the repo? check out this version:
   $ git checkout 3.1.6

   • Adds notice to screen output when a platform's end-of-life state is unclear.
   • Supports three new platforms: CachyOS, macOS Tahoe, and OpenMandriva Lx.
   • FIRE-4586: Accepts NFLOG as a valid logging target when auditing iptables firewall rules.
   • MALW-3280: Improved detection of the Wazuh agent.
   • ACCT-9634: Defines a default auditd log file location for accounting checks.

   +1 more show less

   • Releases older than 6 months are now flagged as old (previously the threshold was higher), surfaced directly in screen output rather than as a generic suggestion.

   6 details in Everything

3. 3.1.5 Jul 29, 2025 · release notes

   Lynis 3.1.5 adds OpenWrt support, Bitdefender detection on Linux, and openSUSE Tumbleweed-Slowroll recognition.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.5 https://github.com/CISOfy/lynis.git
   # already have the repo? check out this version:
   $ git checkout 3.1.5

   • Adds full audit support for OpenWrt, including HostID and HostID2 generation on that platform.
   • Detects Bitdefender antivirus installations on Linux during security audits.
   • Recognizes openSUSE Tumbleweed-Slowroll as a distinct distribution.
   • Extends kernel module checks to also scan under /usr/lib/modules.d.

   4 details in Everything

4. 3.1.4 Jan 28, 2025 · release notes

   Lynis 3.1.4 adds macOS Sequoia support and powerpc64le authentication checks.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.4 https://github.com/CISOfy/lynis.git
   # already have the repo? check out this version:
   $ git checkout 3.1.4

   • Adds macOS Sequoia to the list of recognized platforms for auditing.
   • Supports powerpc64le architecture in the authentication section.
   • Updates the end-of-life (EOL) database with new entries.

   3 details in Everything

5. 3.1.3 Dec 16, 2024 · release notes

   Lynis 3.1.3 adds detection for four new Linux distributions including Fedora Linux Asahi Remix and Garden Linux.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.3 https://github.com/CISOfy/lynis.git
   # already have the repo? check out this version:
   $ git checkout 3.1.3

   • Adds OS detection for Buildroot, Fedora Linux Asahi Remix, Garden Linux, and Peppermint OS.
   • Adds links to blog posts and articles within suggestions to provide context for missing control information.

   2 details in Everything

6. 3.1.2 Sep 26, 2024 · release notes

   Lynis 3.1.2 adds macOS FileVaultFileVaultApple's full-disk encryption feature built into macOS, using XTS-AES-128 to encrypt the startup volume so that data is unreadable without the user's credentials. encryption test, Wazuh integration, and seven new OS detections.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.2 https://github.com/CISOfy/lynis.git
   # already have the repo? check out this version:
   $ git checkout 3.1.2

   └──▷ TRY IT
   Run a full audit on a macOS host to exercise the new FileVault encryption check (CRYP-7932) and macOS app inventory (PKGS-7305).
   copy

   $ sudo lynis audit system

   • Detects seven new Linux/OS platforms: ALT Linux, Athena OS, Container-Optimized OS (Google), Koozali SME Server, Nobara Linux, OSMC, and PostmarketOS.
   • New test CRYP-7932 checks macOS FileVault full-disk encryption status.
   • New test FILE-6398 checks whether the JBD (Journal Block Device) kernel driver is loaded.
   • New test FINT-4344 checks whether the Wazuh agent is running.
   • New test PKGS-7305 queries macOS applications in /Applications and CoreServices.

   +8 more show less

   • Adds Wazuh as a recognized malware scanner, antivirus, and rootkit detection tool (MALW/LOGG checks).
   • Adds ESET Endpoint Antivirus detection to MALW-3200.
   • Adds Microsoft Defender Antivirus detection to MALW-3291.
   • Adds version numbers to Homebrew package output in PKGS-7303.
   • Extends Slackware support with installed-package querying via functionPackageIsInstalled().
   • Adds prosecute and report to LEGAL_BANNER_STRINGS for legal banner checks.
   • Adds inetd package and service name for Ubuntu 24.04 to INSE-8000.
   • Extends CONT-8104 to detect errors (not only warnings) in docker info output.

   13 details in Everything

7. 3.1.1 Mar 17, 2024 · release notes

   Lynis 3.1.1 adds ArcoLinux detection and Redis path updates

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.1 https://github.com/CISOfy/lynis.git
   # already have the repo? check out this version:
   $ git checkout 3.1.1

8. 3.1.0 Mar 11, 2024 · release notes

   Lynis 3.1.0 adds translation support, new OS detections, and SentinelOne integration capabilities.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.1.0 https://github.com/CISOfy/lynis.git
   # already have the repo? check out this version:
   $ git checkout 3.1.0

   • Adds STATUS_NOT_ACTIVE variable to translation files for localizing inactive status messages
   • Adds Indonesian language translation pack

   2 details in Everything

9. 3.0.9 Aug 3, 2023 · release notes

   Lynis 3.0.9 adds plocate file locations, newer MongoDB auth format support, and SSH compression logic update.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.0.9 https://github.com/CISOfy/lynis.git
   # already have the repo? check out this version:
   $ git checkout 3.0.9

   • FILE-6410 check now includes plocate locations for system database queries
   • DBS-1820 updated to recognize the newer style format for Mongo authorization settings
   • SSH-7408 test logic refined to only evaluate Compression if sshd version is < 7.4

   3 details in Everything

10. 3.0.7 Jan 18, 2022 · release notes

    Lynis 3.0.7 adds OpenRC service manager support and detection for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 6, Funtoo Linux, Garuda Linux, and arch-audit

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.7 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 3.0.7

    • openrc is now supported as a service manager, expanding platform coverage beyond systemd and SysVinit.

    1 detail in Everything

11. 3.0.6 Jul 22, 2021 · release notes

    Lynis 3.0.6 adds detection for Artix Linux, macOS Monterey, NethServer, and openSUSE MicroOS

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.6 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 3.0.6

12. 3.0.5 Jul 2, 2021 · release notes

    Lynis 3.0.5 adds OS detection for Arch Linux 32, BunsenLabs, and Rocky Linux

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.5 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 3.0.5

13. 3.0.4 May 11, 2021 · release notes

    Lynis 3.0.4 adds detection for cmd tooling, ELILO bootloader, and new OS support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.4 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 3.0.4

    • ACCT-9670 - Detection of cmd tooling
    • BOOT-5140 - Check for ELILO boot loader presence
    • OS detection of AlmaLinux, Garuda Linux, Manjaro (ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.), and others

    3 details in Everything

14. 3.0.3 Jan 7, 2021 · release notes

    Adds HRDN-7231 detection and Parrot GNU/Linux OS support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.3 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 3.0.3

    • Adds HRDN-7231 check for registered non-native binary formats

    1 detail in Everything

15. 3.0.2 Dec 24, 2020 · release notes

    Lynis 3.0.2 adds detection for Flatcar, NixOS, Solaris svcs, and several new security checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.2 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 3.0.2

    • Adds AUTH-9284 to scan for locked user accounts in /etc/passwd
    • Adds LOGG-2153 detection for loghost configuration
    • Adds TOOL-5130 check for active Suricata daemon
    • Adds OS detection for Flatcar, IPFire, Mageia, NixOS, ROSA Linux, SLES (extended), Void Linux, Zorin OS, OpenIndiana, Shillix, SmartOS, and Tribblix
    • Adds EOL dates for Alpine, macOS, Mageia, OmniosCE, and Solaris 11

    +2 more show less

    • Adds support for Solaris svcs service manager
    • Adds enumeration of Solaris services

    7 details in Everything

16. 3.0.1 Oct 5, 2020 · release notes

    Lynis 3.0.1 adds Alpine/CloudLinux/Kali/Mint/Pop detection, macOS Big Sur support, --slow-warning flag, and Microsoft Defender ATP integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.1 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 3.0.1

    └──▷ TRY IT
    Run Lynis with extended timeout for slow systems to prevent premature warnings
    copy

    $ lynis audit system --slow-warning

    • --slow-warning flag allows tests more time before showing a warning message during scan execution
    • New malware detection support for Microsoft Defender ATP in the MALW-3280 test

    2 details in Everything

17. 3.0.0 Jun 18, 2020 · release notes

    Lynis 3.0.0 adds DevOps/Forensics modes, new auth/crypto/network tests, and systemd unit generation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0

    └──▷ USE IT
    Generate a systemd service file for automated Lynis execution.
    shell copy

    lynis generate systemd-units

    • Adds --devops, --forensics, and --pentest flags to activate specialized audit modes that change the scan behavior based on intent.
    • Adds lynis generate systemd-units subcommand to generate systemd service units for Lynis.
    • Adds AUTH-9229 test to check used password hashing methods.
    • Adds BOOT-5109 test to check for rEFInd boot loader presence.
    • Adds BOOT-5264 test to run systemd-analyze security.

    +9 more show less

    • Adds CRYP-7930 test to verify LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations. encryption is present.
    • Adds CRYP-7931 test to determine if the system uses encrypted swap.
    • Adds CRYP-8004 test to check for hardware random number generator presence.
    • Adds FINT-4340 test to check dm-integrity status on Linux.
    • Adds NETW-2706 test to check DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. configuration for systemd.
    • Adds --usecwd flag to force Lynis to run from the current working directory.
    • Adds disable-plugin profile option in .lynisrc or custom profiles to disable specific plugins.
    • Adds ssl-certificate-paths-to-ignore profile option to exclude certificate paths from scanning.
    • Introduces new reporting key openssh_daemon_running for SSH status detection.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Lynis now runs non-interactive by default; the previous --quick behavior is now the default, and you must use --wait to pause for input.
    • !Profile options changed from key:value format to key=value; existing custom.prf files using colons will need updating or may show warnings.
    • !CLI option -c has been removed; migration path not explicitly defined but implied removal.
    • !CLI options --check-update, --info, and --dump-options have been removed.
    • !CLI option --license-key has been removed.
18. 2.7.5 Jun 24, 2019 · release notes

    Adds detection for BSD-style init systems and Bro/Suricata IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. support to Lynis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.7.5 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.7.5

    • Adds detection for BSD-style (rc.d) init systems on Linux hosts
    • Adds support for integrating with Bro and Suricata intrusion detection systemsintrusion detection systemsAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity.

    2 details in Everything

19. 2.7.4 Apr 21, 2019 · release notes

    Adds generate command and new tests for XFS, inetd/xinetd, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. wrappers, rsh client/server presence.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.7.4 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.7.4

    • Adds the generate subcommand to create configuration files from the current system state
    • Adds FILE-6324 test to discover XFS mount points
    • Adds INSE-8000 and INSE-8100 tests to detect installed inetd and xinetd packages
    • Adds INSE-8102, INSE-8104, INSE-8106 tests for xinetd daemon status and configuration
    • Adds INSE-8200 test for usage of TCP wrappers

    +1 more show less

    • Adds INSE-8300 and INSE-8302 tests to detect presence of rsh client and server

    6 details in Everything

20. 2.7.3 Mar 21, 2019 · release notes

    Lynis 2.7.3 adds detection for being scheduled (e.g., cronjob)

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.7.3 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.7.3

21. 2.7.2 Mar 7, 2019 · release notes

    Lynis 2.7.2 adds lynis show eol command and doas/systemd-boot detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.7.2 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.7.2

    └──▷ TRY IT
    Check if the current OS is approaching end-of-life status
    copy

    $ lynis show eol

    • Adds lynis show eol subcommand to check operating system end-of-life status
    • Adds support for detecting the OpenBSD doas authentication framework (AUTH-9409)
    • Adds support for testing file permissions of doas configuration files (AUTH-9410)
    • Adds detection coverage for the systemd-boot boot loader (BOOT-5117)
    • Adds check for OpenBSD boot daemons (BOOT-5262)

    5 details in Everything

22. 2.7.1 Jan 31, 2019 · release notes

    Adds macOS Mojave support, Slovak translation, and platform-specific detection coverage

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.7.1 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.7.1

    └──▷ USE IT
    Change the UI language to Slovak before running an audit.
    shell copy

    LANG=sk_SK.UTF-8 ./lynis audit system

    • Adds support for scanning macOS Mojave systems.
    • Adds Slovak language translations to the UI.
    • Extends AUTH-9282 checks for Red Hat and its clones.
    • Adds firewall checks for Hands Off!, LuLu, and Radio Silence via FIRE-4534.
    • Adds MariaDB log file deletion filter (LOGG-2190).

    +1 more show less

    • Extends umask checks to include /etc/bash.bashrc.local (SHLL-6230).

    6 details in Everything

23. 2.7.0 Oct 26, 2018 · release notes

    Lynis 2.7.0 adds TOMOYO MACF detection, OpenSSH version checking, and OSSEC daemon status checks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.7.0 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.7.0

    • Adds MACF-6240 to detect the TOMOYO binary for mandatory access control auditing
    • Adds MACF-6242 to check the status of the TOMOYO framework
    • Adds SSH-7406 to detect the installed OpenSSH server version
    • Adds TOOL-5160 to check if the active OSSEC analysis daemon is running

    4 details in Everything

24. 2.6.5 Jun 26, 2018 · release notes

    Lynis 2.6.5 adds Exim mail server test and improves SSH Match block detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.6.5 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.6.5

    • Adds [MAIL-8804] test to verify Exim configuration settings

    1 detail in Everything

25. 2.6.4 May 2, 2018 · release notes

    Lynis 2.6.4 adds Ubuntu 18.04 LTS support and improves DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. validation testing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.6.4 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.6.4

    • Adds initial support for scanning Ubuntu 18.04 LTS systems

    1 detail in Everything

26. 2.6.1 Jan 26, 2018 · release notes

    Lynis 2.6.1 adds system-groups profile option and multi-OS test requirements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.6.1 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.6.1

    • Adds system-groups option to the profile configuration file for enterprise environments
    • Allows tests to require multiple OS versions (e.g., Linux OR NetBSD) using OR logic

    2 details in Everything

27. 2.5.9 Jan 12, 2018 · release notes

    Lynis 2.5.9 adds --noplugins flag and per-key skip-test support for KRNL-6000

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.9 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.5.9

    └──▷ USE IT
    Run Lynis without any external plugins for a faster, isolated scan.
    shell copy

    lynis audit system --noplugins

    Skip a specific sysctl key check within the kernel network test if it is irrelevant to your environment.
    shell copy

    lynis audit system --skip-test=KRNL-6000:net.ipv4.ip_forward

    • --noplugins flag allows skipping plugin execution entirely.
    • Supports skip-test=KRNL-6000:<sysctl-key> to skip specific sysctl keys within the KRNL-6000 test.

    2 details in Everything

28. 2.5.8 Dec 28, 2017 · release notes

    Adds allow-auto-purge profile setting for short-lived systems and a new hardware plugin class.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.8 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.5.8

    • Adds allow-auto-purge option in the Lynis profile configuration to automatically purge data on short-lived systems
    • Adds new hardware plugin class that is enabled by default in the standard profile

    2 details in Everything

29. 2.5.7 Oct 29, 2017 · release notes

    Lynis 2.5.7 adds the --silent flag as an alias for --quiet

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.7 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.5.7

    └──▷ USE IT
    Run Lynis silently without any console output, using the new short flag.
    shell copy

    lynis audit system --silent

30. 2.5.4 Sep 5, 2017 · release notes

    Lynis 2.5.4 adds Norwegian translation, improved OS/PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.4 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.5.4

31. 2.5.3 Aug 17, 2017 · release notes

    Lynis 2.5.3 adds DirectAdmin path support and Ansible detection capability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.3 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.5.3

    • Adds DirectAdmin location to the default configuration paths for web server testing
    • Adds /opt/apache as a recognized target location for Apache installations
    • Enhances OS-level detection capabilities for Linux Containers (LXC)

    3 details in Everything

32. 2.5.2 Jul 10, 2017 · release notes

    Lynis 2.5.2 adds CloudLinux PHP support, macOS High Sierra compatibility, and new kernel dmesg_restrict test.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.2 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.5.2

    • Adds CONT-8102 test to check for dockerd instead of docker -d
    • Adds FIRE-4594 test to check for presence of Advanced Policy Firewall (APF)
    • Adds PKGS-7370 test to restrict debsums usage to Debian systems
    • Adds KRNL-6000 test to verify kernel.dmesg_restrict setting
    • Enables support for PHP on CloudLinux

    5 details in Everything

33. 2.5.1 May 31, 2017 · release notes

    Lynis 2.5.1 adds macOS support to BOOT-5104 and CSFCSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. testing mode detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.1 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.5.1

    • BOOT-5104 now runs on macOS for boot sector checks
    • FIRE-4524 detects if ConfigServer Firewall (CSF) is in testing mode

    2 details in Everything

34. 2.5.0 May 3, 2017 · release notes

    Lynis 2.5.0 adds support for older macOS versions and new detection tests

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.0 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.5.0

    • Adds ROOTDIR variable to replace fixed paths in configuration
    • Adds support for macOS Lion and Mountain Lion via updated OS version checks
    • Adds MALW-3280 test for extended Symantec component detection
    • Adds PKGS-7332 test for macOS ports tool and installed packages
    • Adds TOOL-5120 test for Snort detection

    +1 more show less

    • Adds TOOL-5122 test for Snort configuration file

    6 details in Everything

35. 2.4.8 Mar 29, 2017 · release notes

    Lynis 2.4.8 adds MAIL-8820 for new Postfix checks and shows atomic test results in reports.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.8 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.4.8

    • Improves report output to display atomic test results (e.g. Show atomic test in report)

    1 detail in Everything

36. 2.4.6 Mar 15, 2017 · release notes

    Lynis 2.4.6 adds Avira malware detection, Manjaro Linux support, and package-based file verification functions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.6 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.4.6

    • Adds Avira to the list of supported malware scanners (test MALW-3280)
    • Adds Manjaro Linux distribution support
    • Adds FileInstalledByPackage function supporting dpkg and rpm package managers
    • Marks Arch Linux version as rolling release instead of unknown

    4 details in Everything

37. 2.4.5 Mar 9, 2017 · release notes

    Lynis 2.4.5 adds host alias support in profiles and improves Solaris/FreeBSD coverage

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.5 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.4.5

    • Improves detection for iptables modules when using OpenVZ (FIRE-4502)
    • Enhances package audit capabilities for FreeBSD (PKGS-7381)

    2 details in Everything

38. 2.4.4 Mar 1, 2017 · release notes

    Lynis 2.4.4 adds MAIL-8817 test for Postfix configuration errors and refines existing checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.4 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.4.4

    └──▷ TRY IT
    Verify Postfix configuration integrity using the new detection module.
    copy

    $ lynis audit system --test MAIL-8817

    • Improves AUTH-9308 test for sulogin string detection on Debian systems
    • Improves FILE-6372 handling of comment lines in /etc/fstab

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The update release command has been removed
39. 2.4.3 Feb 22, 2017 · release notes

    Adds colors and data upload profile options, plus new AUTH/MAIL/TIME tests

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.3 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.4.3

    • Allows colored output tuning via the colors=yes/no profile option in .lynisrc
    • Enables configuring whether to upload scan data via a new profile option (typically upload_data)
    • Adds new test TIME-3148 to detect the TZ environment variable

    3 details in Everything

40. 2.4.2 Feb 15, 2017 · release notes

    Lynis 2.4.2 adds MongoDB detection tests and refines SSH reporting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.2 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.4.2

    └──▷ TRY IT
    Run a system scan to detect MongoDB presence and verify its auth configuration
    copy

    $ lynis audit system --tests DBS-1818,DBS-1820

    • Adds DBS-1818 test to detect MongoDB installations
    • Adds DBS-1820 test for MongoDB authentication checks
    • Updates SSH-7408 to support prohibit-password PermitRootLogin filtering
    • Changes FIRE-4512 rule to lower the minimum threshold for iptables firewall rules

    4 details in Everything

41. 2.4.1 Feb 9, 2017 · release notes

    Lynis 2.4.1 adds Trend Micro/Cylance macOS support, profile hostid config, and iptables-save detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.1 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.4.1

    • Adds hostid and hostid2 configuration options to the Lynis profile for custom host identification
    • Adds new detection capabilities for iptables-save as a binary during scanning
    • Adds support for Trend Micro and Cylance security products on macOS

    3 details in Everything

42. 2.4.0 Oct 27, 2016 · release notes

    Lynis 2.4.0 adds macOS support, new show and upload-only commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.0 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.4.0

    └──▷ USE IT
    Upload only the audit results to a remote server without executing a full scan.
    shell copy

    lynis upload-only

    Display the current system's hardware and container status.
    shell copy

    lynis show environment

    Retrieve the machine's HostIDs for unique identification.
    shell copy

    lynis show hostids

    • Adds system integrity test group for system integrity checks.
    • Adds lynis upload-only subcommand to upload audit data without running a full audit.
    • Adds lynis show hostids, lynis show environment, and lynis show os subcommands to display system details.
    • Adds support for ClamAV's clamconf utility integration.

    4 details in Everything

43. 2.3.4 Sep 27, 2016 · release notes

    Lynis 2.3.4 adds lynis show details for test ID lookup, arch-audit support, and nftables detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.3.4 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.3.4

    • Adds lynis show details <test_id> to display relevant test sections directly via CLI
    • Adds arch-audit integration in PKGS-7320/PKGS-7322 for vulnerable package scanning on Arch Linux
    • Enhances firewall detection with new FIRE-4520 check for empty nftables rulesets

    3 details in Everything

44. 2.3.3 Aug 23, 2016 · release notes

    Lynis 2.3.3 adds --bin-dirs, --root-dir, OpenStack detection, and Redis tests

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.3.3 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.3.3

    • Adds --bin-dirs flag to define binary directories for scanning
    • Adds --root-dir flag to specify an alternative root file system for forensics
    • Adds new setting 'show-report-solution' to include solutions in reports
    • Adds OpenStack platform detection capabilities
    • Adds Redis configuration tests (DBS-1882, DBS-1884, DBS-1886, DBS-1888) for best practices

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Customized profiles including sysctl settings must be altered to match the format in default.prf
45. 2.3.2 Aug 9, 2016 · release notes

    Lynis 2.3.2 adds show groups/categories, update check command, quick mode default, and --tests-from filters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.3.2 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.3.2

    └──▷ TRY IT
    List all security groups available in your current Lynis installation to plan a targeted audit.
    copy

    $ lynis show groups

    Run a full system scan but limit the tests to those within the AUTH category for a faster authentication-focused review.
    copy

    $ lynis audit system --tests-from-group AUTH

    Check remotely whether a newer version of Lynis is available before committing to an upgrade.
    copy

    $ lynis update check

    • Adds lynis show categories and lynis show groups commands to list available classification schemes for tests
    • Adds --tests-from-category <category> and --tests-from-group <group> options to filter scans by classification
    • Adds lynis update check command as the preferred method to verify availability of newer Lynis versions
    • Adds lynis show changelog command (optionally with a version argument) to review historical release notes
    • Enables quick mode by default, allowing Lynis to run through sections without pausing; use --wait to restore per-section breaks

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Default scan behavior changed from pausing after each section to continuous execution (quick mode); scripts relying on interactive pauses must now add the --wait option
46. 2.3.0 Jul 13, 2016 · release notes

    Lynis 2.3.0 adds developer mode, multi-profile support, DB2 and systemd detection, and the lynis show helper.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.3.0 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.3.0

    └──▷ USE IT
    Enable verbose debug output for testing a custom Lynis plugin
    shell copy

    lynis audit system --developer

    Configure CI to fail the pipeline if any security warnings are found during the audit
    config copy

    # Add to custom.prf
    error-on-warnings=yes

    View which settings are currently active after merging default and custom profiles
    shell copy

    lynis show settings

    • Adds --developer flag and developer=yes profile option to enable verbose test details for plugin development
    • Adds custom.prf profile inheritance so custom settings merge with default.prf without modifying the base file
    • Adds error-on-warnings=yes profile option to make Lynis exit with code 78 when warnings are detected, enabling strict CI pipelines
    • Adds lynis show [options|commands|version|settings] helper subcommand to display help, available commands, version, and active configuration values
    • Adds DB2 instance detection test (DBS-1860) that reports the database status in the audit report

    +3 more show less

    • Adds systemd service manager detection and reporting capability
    • Adds Brew package manager support for Mac OS X systems
    • Adds XFS file system detection and checks mount options for /dev/shm and /var/tmp

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --config flag has been removed; use lynis show profiles instead to view detected configuration files
    • !The --quiet option no longer shows warnings by default; add --show-warnings-only if you need warning output in logs
    • !Lynis now exits with error code 0 even when warnings are found; use the error-on-warnings=yes profile option to exit with code 78 instead
47. 2.2.0 Mar 18, 2016 · release notes

    Lynis 2.2.0 adds PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. plugin, nftables/UEFIUEFIA firmware specification maintained by the UEFI Forum that replaces legacy BIOS, defining how an OS and hardware initialize at boot. Cyber tools target or hook it to inspect pre-OS execution environments. testing, DNF support, and profile proxy settings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.2.0 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.2.0

    • Introduces the PAM plugin to analyze two-factor authentication methods, password history, and brute-force protection
    • Adds FIRE-4536 and FIRE-4538 tests for nftables status checking and configuration validation
    • Enables boot_uefi_booted and boot_uefi_booted_secure fields in the report to detect UEFI boot and Secure Boot status
    • Adds compliance_standards profile option to select CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmarks, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., ISO27001/ISO27002, or PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. for testing
    • Supports Fedora's DNF package manager in tests PKGS-7350, PKGS-7352, and PKGS-7354 for package listing, security notices, and integrity checks

    +1 more show less

    • Adds proxy configuration support in the profile to allow report uploads via HTTP or SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxies

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Renamed test FIRE-4511 to FIRE-4502
48. 2.1.1 Jul 22, 2015 · release notes

    Lynis 2.1.1 adds Docker info checks, Chef integration, and automatic updater stub

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1.1 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.1.1

    • CONT-8102 adds a test for Docker daemon status and gathers basic details
    • CONT-8104 adds a test to check docker info for any Docker warnings
    • CONT-8106 adds a test to check total, running and unused Docker containers
    • Support added for Chef automation platform
    • Initial automatic updater implemented to allow scheduled updates from trusted sources

    5 details in Everything

49. 2.1.0 Apr 17, 2015 · release notes

    Lynis 2.1.0 adds new configuration plugins for SSH and login.defs, extending compliance checks on AIX, HP-UX, and Mac OS.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1.0 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.1.0

    • PLGN-4802 allows scanning SSH settings via the Enterprise plugin interface
    • PLGN-4804 enables checking login.defs configuration through the Enterprise plugin interface

    2 details in Everything

50. 2.0.0 Feb 25, 2015 · release notes

    Lynis 2.0 introduces Docker build auditing helpers, systemd/nftables/Docker technology support, and --dump-options CLI flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.0 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 2.0.0

    └──▷ USE IT
    List all available configuration options for the current Lynis installation.
    shell copy

    lynis audit system --dump-options

    Save the audit report to a specific file instead of the default directory.
    shell copy

    lynis audit system --report-file /tmp/lynis_audit.txt

    • Adds --dump-options to dump all available audit options to stdout.
    • Adds --report-file <path> to override the default audit report output location.
    • Adds support for systemd, Docker, and nftables technologies in audit tests.
    • Adds a Docker build file auditing helper utility.

    4 details in Everything

51. 1.6.4 Nov 4, 2014 · release notes

    Lynis 1.6.4 adds Boot loader detection for AIX and OpenBSD, plus getcap/lsvg binary detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.4 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 1.6.4

    • Adds Boot loader detection for AIX systems [BOOT-5102]
    • Adds support for gathering volume groups on AIX
    • Adds filesystem_ext field to the test report
    • Adds uptime detection for OpenBSD systems

    4 details in Everything

52. 1.6.3 Oct 14, 2014 · release notes

    Lynis 1.6.3 adds non-privileged scan mode, systemd example, and dozens of new security checks for Linux/macOS

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.3 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 1.6.3

    └──▷ USE IT
    Automate nightly Lynis scans using the provided systemd templates.
    shell copy

    cp etc/lynis/systemd/* /etc/systemd/system/
    systemctl daemon-reload
    systemctl enable lynis.timer

    • Adds non-privileged scan mode: running Lynis without root permissions now starts a reduced-scope scan instead of failing.
    • Adds system-level coverage with new tests: Shellshock (SHLL-6290), Snoopy usage (ACCT-9636), qdaemon config/jobs/status (PRNT-2416, PRNT-2420, PRNT-2418), GRUB boot loader password (BOOT-5122), ClamXav on Mac OS X (MALW-3288), Gentoo vulnerable packages (PKGS-7393), Gentoo package listing (PKGS-7304), YUM built-in security options (PKTS-7386), and Mac OS uptime (BOOT-5202).
    • Adds systemd service and timer example file to help users automate scheduled scans.
    • Improves nginx insecure SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. protocol detection in config files (HTTP-6710), skips specific directories for nginx log searching (HTTP-6720), and refines mod_evasive detection on Gentoo (HTTP-6640).
    • Adds grub2-install to the list of required binaries for boot loader testing.

    5 details in Everything

53. 1.6.2 Sep 23, 2014 · release notes

    Lynis 1.6.2 adds VM detection, symlink path checks, and bash completion.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6.2 https://github.com/CISOfy/lynis.git
    # already have the repo? check out this version:
    $ git checkout 1.6.2

    • Adds IsVirtualMachine function to detect running systems in various VM/container environments (Bochs, KVMKVMA Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed., LXC, VMware, etc.)
    • Adds ShowSymlinkPath function to reveal the target path behind a symlink
    • Adds Bash completion script for Lynis command-line usage
    • Adds detection of machine ID via systemd
    • Adds support for ss binary to gather listening ports (NETW-3012)

    +1 more show less

    • Adds drill binary support to check for Lynis updates

    6 details in Everything